CVE-2025-9288

CRITICAL

sha.js < 2.4.11 - Input Data Manipulation via Improper Input Validation

Title source: llm

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

Core 4

Core References

Exploit, Vendor Advisory vendor-advisory

Third Party Advisory related

Mailing List

Issue Tracking, Patch patch

CVSS v3 9.1

EPSS 0.0006

EPSS Percentile 19.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

CWE

CWE-20

Status published

Products (2)

browserify/sha.js < 2.4.11

npm/sha.js 0 - 2.4.12npm

Published Aug 20, 2025

Tracked Since Feb 18, 2026